A computer is comprised of various hardware components, typically including a chip containing program instruction for implementing a Basic Input/Output System (“BIOS”), a Central Processing Unit (“CPU” or “processor”), Random Access Memory (“RAM”), one or more storage devices such as a hard drive and optical drives, and one or more Input/Output (“I/O”) devices such as a monitor, a mouse, and a keyboard. When a computer is powered on, the processor first accesses the chip containing the BIOS program instructions which are then executed by the CPU. The BIOS program instructions are designed to identify and initialize the various components in communication with the CPU. The BIOS program instructions typically end by invoking an operating system (“OS”), such as Microsoft Windows or Linux.
These operating systems may be configured to provide different access levels for different users. Typically, users are divided into two groups: Administrators or root users, who have unrestricted access to all components of the computer, and standard or guest users who have restricted or limited access to computer components. Standard users may be prevented from changing start up or boot parameters such as the designation of the operating system to be invoked at the end of the BIOS program instructions. Standard users may also be restricted from accessing certain components, such as the BIOS chip or portions of components such as a hard drive.
By configuring access levels, content may be protected by preventing standard users from accessing the content. However, a user who obtains administrator or root user level access can access the protected content. Various techniques have been used to prevent access by either an administrator or standard users to content, such as sensitive algorithms or cryptographic keys.
In one technique, data to be protected is stored on a Peripheral Component Interconnect (PCI) card in communication with the CPU via a PCI bus. For example, a sensitive data processing algorithm may be stored on the PCI board. When an application needs to process data using the algorithm, the data may be passed to the PCI card as the argument of a function call. The PCI card receives the argument and inputs it to the data processing algorithm stored on the PCI board. The result of the algorithm is then output by the PCI card. This technique allows both administrator and standard users to utilize the algorithm to process data while preventing direct access to the algorithm. One disadvantage of this technique is that it requires the addition of a PCI card to the computer.
Another technique is hardware virtualization. Hardware virtualization is a method of allocating hardware for use by specific software. Hardware virtualization may be implemented using a Virtual Machine Monitor (“VMM”), or hypervisor, to support the operation of one or more operating systems, i.e., virtual machines (“VM”), on a single computer by allocating portions of available hardware for use by each VM.
Virtualization-based rootkits suffer from two main problems. Because processors only include one set of virtualization features, whoever starts using them first “wins.” Therefore, these rootkits can be defeated by always using these features before the rootkit gets a chance to initiate. The second problem is that there are ways to detect whether a virtualization-based rootkit is resident. In addition, recent virtual machine monitors have become so complex that it is difficult to determine all possible security vulnerabilities. As a result, many virtual machine monitors do not provide much more protection than the traditional boundary between user-space and the kernel. What is needed is a method of protecting content in a computer that provides a high level of security with the minimal addition of components and complexity.